CVE-2013-1407: Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Ma...

Security readout for executives and security teams

This is an old WordPress plugin XSS issue in Events Manager and Events Manager Pro. If a site still runs affected versions, an attacker could inject script or HTML through event and admin-related parameters, potentially affecting visitors or administrators who view the malicious content. Exposure is most likely on legacy WordPress sites still running Events Manager before 5.3.5 or Events Manager Pro before 2.2.9, especially where event registration is enabled or admin workflows process affected input. Treat this as a legacy exposure cleanup item with higher urgency for public WordPress sites still using the affected plugins. It is not KEV-supported active exploitation in the provided bundle, but unpatched XSS can still create meaningful business risk. Mitigation focus: Upgrade Events Manager to 5.3.5 or later.; Upgrade Events Manager Pro to 2.2.9 or later.; If upgrade is blocked, check current vendor guidance..

Prepared

Jun 14, 2026, 07:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.